According to new Symantec research, attackers have disguised information-stealing malware as third-party add-ons and cheats for Blizzard’s online card game Hearthstone.

Hearthstone players looking to gain an unfair advantage often turn online for tools to help them play better or earn more rewards. In this case, attackers created third-party programs that promise to benefit Hearthstone players, but in reality can compromise their computers with malicious software capable of opening a back door, recording from their webcam, logging key strokes, and stealing passwords.

In most cases, the use of these tools is considered as cheating, as they give players an unfair advantage. Blizzard, the game’s creator, does not approve of these services. This isn’t the only downside; Symantec observed that some of the third-party services contain malware. If a player installs them, then attackers may be able to open a back door on their computer, and steal sensitive information and Bitcoins.

Rather than paying money or using in-game methods, some players may try to cheat to get additional gold and dust. This can lead them to applications like Hearthstone Hack Tool v2.1, which promises that “gold and dust won’t be a problem anymore.” Such applications are a total scam; they do not work.

Symantec has recently observed Trojan.Coinbitclip posing as a Hearthstone gold- and dust-hacking tool. Because Bitcoin addresses are long and include random characters, many users who mine Bitcoins use a clipboard to facilitate the process. Trojan.Coinbitclip hijacks the user’s clipboard and replaces the user’s Bitcoin address with one from its own list—this is how the malware steals someone’s Bitcoin. The sample Symantec observed had 10,000 Bitcoin addresses in its body. The Trojan selects an address from the list that most closely resembles the address it is replacing.